We have unfortunately gotten off to a rocky start.
For example, the MSVC compiler's /Qspectre flag—one of the first
compiler defenses [1]}—inserts mitigations by finding Spectre
vulnerability patterns.
Since these patterns are not based in any rigorous analysis, the compiler
easily misses similarly vulnerable code patterns [2]}.
As another example, Chrome adopted process isolation as its core defense
mechanism against Spectre attacks [3]}.
This is also unsound: [4]} shows that Spectre attacks can be
performed across the process boundary, and [5]} shows
how to read cross-origin data in the browser.
More generally, there have been many defense mechanisms against Spectre that
turned out to be unsound, incomplete (and thus missed possible attacks), or
overly conservative and thus slow.
